private-ai-proxy 0.2.0-beta.1-linux-arm64 → 0.2.0-beta.1

package/README.md

@@ -1,3 +1,46 @@
-# private-ai-proxy 0.2.0-beta.1-linux-arm64
+# Private AI Proxy
 
-The native linux-arm64 binaries of [private-ai-proxy](https://www.npmjs.com/package/private-ai-proxy). Install `private-ai-proxy` instead of this version.
+Private AI Proxy runs AI coding agents through a local, user-owned gateway that verifies confidential-computing evidence before forwarding requests.
+
+## Install
+
+```sh
+npm install --global private-ai-proxy
+```
+
+The package installs `pap` as the preferred command. `private-ai-proxy` is the
+full-name alias and `aci` is a legacy alias kept for existing scripts; all three
+run the same CLI. The native executables for each supported platform ship as a
+version of this package, such as `private-ai-proxy@<version>-linux-x64`, that
+the package installs as an optional dependency. Your package manager installs
+only the one for the current operating system and CPU architecture. Do not
+install with `--omit=optional` or `--no-optional`.
+
+Install `private-ai-proxy` (the stable release), `private-ai-proxy@beta`, or an
+exact version such as `private-ai-proxy@0.2.0`. Do not use a prerelease range
+such as `private-ai-proxy@^0.2.0-beta.1`: it can resolve to a platform version
+(for example `0.2.0-beta.2-linux-x64`) instead of the installable package.
+
+Supported platforms are macOS, Linux with glibc 2.35 or newer, and Windows, each
+on arm64 and x64. musl-based Linux distributions such as Alpine are not
+supported.
+
+## Use
+
+```sh
+pap --help
+pap service start
+pap service status
+pap app open --web
+```
+
+The CLI, service, and credential helper are distributed together so the local
+service can start the matching binaries from the same installation. The
+service can also host the management UI on `127.0.0.1` (off by default): set a
+password with `pap settings set web-ui.password`, enable it with
+`pap settings set web-ui.enabled true`, then open the address from `pap app open --web`
+and sign in. For another machine, prefer an SSH tunnel or Tailscale;
+read [Remote Access](https://github.com/Dstack-TEE/private-ai-gateway/blob/main/apps/desktop/docs/cli.md#remote-access)
+before listening on a LAN address over plain HTTP.
+
+Source and release notes: https://github.com/Dstack-TEE/private-ai-gateway

package/bin/aci.cjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+"use strict";
+
+// npm's Windows shims run a bin script without the name it was invoked by, so
+// the legacy `aci` command has its own entry that passes that name on.
+require("./private-ai-proxy.cjs").run("aci");

package/bin/private-ai-proxy.cjs

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+"use strict";
+
+const { spawnSync } = require("node:child_process");
+const { accessSync, constants, realpathSync } = require("node:fs");
+const path = require("node:path");
+
+// Each target's native binaries are a version of this package, such as
+// private-ai-proxy@1.2.3-linux-x64, installed through an optional dependency
+// alias such as private-ai-proxy-linux-x64. The package manager installs only
+// the one whose os/cpu/libc match, as for @openai/codex's bin/codex.js.
+const supportedTargets = [
+  "darwin-arm64",
+  "darwin-x64",
+  "linux-arm64",
+  "linux-x64",
+  "win32-arm64",
+  "win32-x64",
+];
+const muslMessage =
+  "Linux builds require glibc 2.35 or newer; musl-based distributions such as Alpine are not supported";
+
+function platformPackage(platform, arch) {
+  const target = `${platform}-${arch}`;
+  if (!supportedTargets.includes(target)) return undefined;
+  return {
+    alias: `private-ai-proxy-${target}`,
+    target,
+    executable: `vendor/private-ai-proxy${platform === "win32" ? ".exe" : ""}`,
+  };
+}
+
+// The global reinstall command for the package manager that owns this copy,
+// detected from its install path as bin/codex.js does.
+function reinstallCommand(version) {
+  const spec = `private-ai-proxy@${version}`;
+  let location = __dirname;
+  try {
+    location = realpathSync(__dirname);
+  } catch {
+    // Fall back to the lexical path.
+  }
+  if (/[\\/]\.bun[\\/]install[\\/]global[\\/]/.test(location)) return `bun add --global ${spec}`;
+  if (/[\\/]\.pnpm[\\/]/.test(location)) return `pnpm add --global ${spec}`;
+  return `npm install --global ${spec} --include=optional`;
+}
+
+// Only consulted after a failure: npm skips the glibc package on musl, and
+// package managers that ignore `libc` install a binary musl cannot load.
+function isLinuxWithoutGlibc() {
+  if (process.platform !== "linux") return false;
+  try {
+    process.report.excludeNetwork = true;
+    return !process.report.getReport().header.glibcVersionRuntime;
+  } catch {
+    return false;
+  }
+}
+
+function fail(message) {
+  console.error(`private-ai-proxy: ${message}`);
+  process.exitCode = 1;
+}
+
+// `command` becomes the binary's argv[0], as a symlink named after it would.
+function main(command) {
+  const target = `${process.platform}-${process.arch}`;
+  const platform = platformPackage(process.platform, process.arch);
+  if (!platform) {
+    fail(`unsupported platform ${target}; supported platforms are ${supportedTargets.join(", ")}`);
+    return;
+  }
+
+  const version = require("../package.json").version;
+  const expectedVersion = `${version}-${platform.target}`;
+  let manifestPath;
+  try {
+    manifestPath = require.resolve(`${platform.alias}/package.json`);
+  } catch (error) {
+    if (error?.code !== "MODULE_NOT_FOUND") throw error;
+    fail(isLinuxWithoutGlibc()
+      ? muslMessage
+      : `the native binaries for ${target} (private-ai-proxy@${expectedVersion}) are not installed. `
+        + "Optional dependencies were omitted (--omit=optional or --no-optional) or their download failed. "
+        + `Reinstall with: ${reinstallCommand(version)}`);
+    return;
+  }
+
+  // An update that could not replace the native package, for example because
+  // a running process locked its files on Windows, leaves an older version.
+  const installedVersion = require(manifestPath).version;
+  if (installedVersion !== expectedVersion) {
+    fail(`the installed native binaries are private-ai-proxy@${installedVersion}, expected ${expectedVersion}. `
+      + `Stop any running private-ai-proxy processes, then reinstall with: ${reinstallCommand(version)}`);
+    return;
+  }
+
+  const executable = path.join(path.dirname(manifestPath), platform.executable);
+  try {
+    accessSync(executable, process.platform === "win32" ? constants.F_OK : constants.X_OK);
+  } catch {
+    fail(`the native executable is missing or not executable in ${path.dirname(manifestPath)}. `
+      + `Reinstall with: ${reinstallCommand(version)}`);
+    return;
+  }
+
+  const result = spawnSync(executable, process.argv.slice(2), {
+    argv0: command,
+    stdio: "inherit",
+    windowsHide: false,
+  });
+  if (result.error) {
+    if (result.error.code === "ENOENT" && isLinuxWithoutGlibc()) {
+      fail(muslMessage);
+      return;
+    }
+    throw result.error;
+  }
+  if (result.signal) {
+    process.kill(process.pid, result.signal);
+    return;
+  }
+  process.exitCode = result.status ?? 1;
+}
+
+function run(command) {
+  try {
+    main(command);
+  } catch (error) {
+    fail(error instanceof Error ? error.message : String(error));
+  }
+}
+
+if (require.main === module) run("private-ai-proxy");
+
+module.exports = { platformPackage, run, supportedTargets };

package/package.json

@@ -1,26 +1,34 @@
 {
   "name": "private-ai-proxy",
-  "version": "0.2.0-beta.1-linux-arm64",
-  "description": "Native Private AI Proxy binaries for linux-arm64",
+  "version": "0.2.0-beta.1",
+  "description": "Local verifying gateway for confidential AI inference",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Dstack-TEE/private-ai-gateway.git"
+    "url": "git+https://github.com/Dstack-TEE/private-ai-gateway.git",
+    "directory": "apps/desktop/npm/private-ai-proxy"
   },
   "homepage": "https://github.com/Dstack-TEE/private-ai-gateway#readme",
-  "os": [
-    "linux"
-  ],
-  "cpu": [
-    "arm64"
-  ],
-  "libc": [
-    "glibc"
-  ],
-  "preferUnplugged": true,
+  "bugs": "https://github.com/Dstack-TEE/private-ai-gateway/issues",
+  "bin": {
+    "private-ai-proxy": "bin/private-ai-proxy.cjs",
+    "pap": "bin/private-ai-proxy.cjs",
+    "aci": "bin/aci.cjs"
+  },
   "files": [
-    "vendor"
+    "bin"
   ],
+  "engines": {
+    "node": ">=18"
+  },
+  "optionalDependencies": {
+    "private-ai-proxy-darwin-arm64": "npm:private-ai-proxy@0.2.0-beta.1-darwin-arm64",
+    "private-ai-proxy-darwin-x64": "npm:private-ai-proxy@0.2.0-beta.1-darwin-x64",
+    "private-ai-proxy-linux-arm64": "npm:private-ai-proxy@0.2.0-beta.1-linux-arm64",
+    "private-ai-proxy-linux-x64": "npm:private-ai-proxy@0.2.0-beta.1-linux-x64",
+    "private-ai-proxy-win32-arm64": "npm:private-ai-proxy@0.2.0-beta.1-win32-arm64",
+    "private-ai-proxy-win32-x64": "npm:private-ai-proxy@0.2.0-beta.1-win32-x64"
+  },
   "publishConfig": {
     "access": "public"
   }

package/vendor/private-ai-proxy-service

@@ -1,4 +0,0 @@
-[diffend] Oversized file quarantined before diffing.
-name: package/vendor/private-ai-proxy-service
-size: 34214056 bytes
-sha256: 2fc03c57413f6a3c09fc2dc50f4fd9bb878f5b19f7d5198dbc3038cfd8b04d81